Follow each setting from the connection entry point to the outbound policy. The examples below illustrate field structure; they are not complete, runnable configurations. Add proxy definitions and verify all referenced names before use.
Rule mode checks connections against the list from top to bottom. The first matching rule determines the target policy. Domain suffix rules work well for grouping sites, while CIDR rules are useful for local networks; the final MATCH rule catches everything else. Unlike global mode, which sends all traffic through one selected route, rule-based routing handles different types of connections separately. Before editing, verify the proxy group names and place specific rules ahead of broader ones. If traffic takes the wrong route, inspect the matched rule in the connection log instead of repeatedly switching proxies.
Proxy groups separate rule targets from specific outbound proxies. With select, you choose manually; url-test picks a proxy based on checks against a specified URL; fallback tries candidates in order until it finds one available. A health check only indicates whether its test target is reachable, not how every website will perform. Referencing a proxy group in rules makes it easier to swap proxies later than hard-coding proxy names in every rule. After importing a subscription, check that all group references exist and that each automatic group's test URL and interval suit your needs.
DNS handles name resolution, while Fake-IP uses mapped addresses to associate domains with subsequent connections, allowing the core to apply domain rules. Fake-IP is not an outbound proxy and cannot fix an unreachable proxy. Unlike returning real addresses directly, address mapping relies more heavily on requests passing through the same core processing path. If local device discovery or a particular app has compatibility issues, adjust the relevant domain filters. Before troubleshooting, confirm that system DNS queries reach the core, then check the upstream resolver. Avoid changing several settings at once.
TUN receives traffic through a virtual network interface and can handle apps that ignore system proxy settings. Unlike changing only browser or system proxy settings, TUN affects routing, permissions, and DNS capture, so its reach is broader. Get the standard proxy path working first, then enable TUN separately and test it. Automatic routing does not guarantee that every interface will be detected correctly. If the device also runs another VPN, container network, or virtual machine, check the routing table and exclusions. After disabling TUN, verify that system networking has recovered.
The external control API lets clients or dashboards inspect connections, switch policies, and change runtime settings. It is a separate entry point from mixed-port, which accepts proxy traffic; the two are not interchangeable. Compared with editing configuration files directly, the API is useful for monitoring and temporary changes, but whether runtime changes persist depends on the client. For local access, bind it to the loopback address. For remote management, configure authentication and access restrictions. Never expose the control API to an untrusted network or share a configuration containing credentials.
mixed-port: 7890
allow-lan: false
external-controller: 127.0.0.1:9090
log-level: info
Check configuration in a consistent order: first confirm that connections reach the core, then verify DNS resolution and rule matches, and finally check the proxy group and actual outbound route. A client connection toggle alone cannot tell you whether an app bypassed the proxy, DNS failed, or the remote connection was unreachable. Match logs and connection records to a specific browsing attempt so you can tell whether a change took effect.
Clash Clients for Every Platform
The client handles the interface, configuration management, and system integration; the core processes connections. Traffic capture can differ across platforms even with the same configuration, so check your processor architecture and system requirements before installing.
Windows
A good fit for desktop browsers, developer tools, and everyday apps. The download page lists clients such as Clash Plus and Clash Verge Rev in order, making it easier to compare their interfaces and system integrations.
Check your system's processor architecture before installing. For your first test, enable the system proxy and verify browser access; use TUN only if you need to capture traffic from other apps. If the client reports a listener error, check whether the port is already in use. Avoid running multiple cores on the same port.
Choose the right installer for Apple Silicon or Intel. Settings vary between clients such as Clash Plus and Clash Verge Rev, so check the imported rules and proxy groups separately.
System proxy settings, background services, and network extensions work at different levels. If macOS asks for permission, confirm the prompt comes from the client you just installed and grant access through the system dialog. Before switching clients, quit the old one to prevent leftover proxy settings from confusing your connection tests.
Choose an installer for your device architecture, import a compatible configuration, and approve the system VPN connection. Mobile clients typically capture traffic through a VPN interface, unlike desktop setups that only configure the system proxy.
Test on both Wi-Fi and mobile data. If something breaks after switching networks, check DNS resolution and outbound connectivity first. If the connection frequently drops in the background, review battery optimization and background activity restrictions. Check app-based routing separately from domain rules.
The download page links to Clash Plus on the App Store and lists its official website, clashplus.io. After installing, import a configuration using a method supported by the client, then approve the system connection.
Similar client names do not guarantee identical configuration support. Before importing, check which protocols and fields the client supports. After connecting, verify the selected policy and test actual access. If another VPN is configured, check which connection is active before assuming the system status reflects the core's state.
Desktop users can compare Clash Verge Rev and FlClash. If you are setting up a server or router, or prefer to manage the service yourself, the download page also links to the mihomo core. Check package format, processor architecture, and desktop runtime dependencies separately; a filename containing Linux is not enough to confirm compatibility.
Running the core from the command line does not automatically make your browser use its listening port. Set the proxy in the app, desktop proxy settings, or environment variables, and decide whether TUN is needed for your use case. For a system service, also check the run user, configuration path, working directory, and log location. This helps avoid a service failing even though it works in an interactive terminal.
Start with a basic connection you can verify, then add automatic health checks, overrides, or TUN. Change one variable at a time and keep a restorable copy of your configuration.
STEP 01
Import and Activate a Configuration
Add a subscription link on the client's configuration or subscription page, or import a local YAML file. After it downloads, check that proxy groups and rules appear, then set the configuration as active. Adding it to the list does not necessarily mean it has been loaded.
Subscription links may contain access credentials, so store them somewhere secure. If an import fails, check the error line and field name, then confirm the link returns configuration data rather than a login page. Never post the full link in a public forum.
STEP 02
Choose a Mode and Policy
For everyday use, start with rule mode and choose an available proxy in the main group. Global mode can help with temporary comparisons, but it changes routing decisions; it cannot fix incorrect DNS or traffic that never reaches the core.
Make sure the core is running, then enable the system proxy or connection toggle for your platform. Test the desktop system proxy and TUN separately. There is no need to enable every traffic-capture option before basic access is confirmed.
STEP 03
Check the Actual Connection Log
Open a website and check the connection page to see which rule matched and which proxy group and outbound proxy were used. Then test a destination expected to connect directly. Confirm both paths work as intended instead of relying on the toggle's appearance.
If access fails, note the time and app, then check the system proxy, mode, proxy, DNS, and firewall in order. After quitting the client, make sure the system proxy has returned to normal; leftover settings can cause network failures that look like proxy issues.
To decide whether a client suits your device, check the core's capabilities, the client's integration, and its release notes separately. An open-source license explains how the code may be used; it does not replace checking configuration requirements and runtime permissions.
How Clash, Clash Meta, and mihomo Are Related
Clash is a major foundation of this proxy configuration ecosystem. Clash Meta was a name used by a related fork, and mihomo is the name now used for that fork's core. Older Clash Meta guides therefore often have a technical connection to current mihomo documentation, but that does not mean every legacy field still has the same meaning. When using older configurations, check the current core documentation, especially for DNS, TUN, and provider options.
Software with Clash in its name does not necessarily use the same core. A client may bundle a specific core build or let you switch between cores. If a field is unsupported, a protocol is not recognized, or an import behaves differently, first check which core the client actually loaded. Then determine whether the issue is syntax, a feature difference, or client-side configuration conversion. This site provides client downloads and configuration resources; it is not the development project for any client or core.
What Clients and Configurations Each Handle
Graphical clients typically handle subscription updates, system proxy toggles, service installation, and connection views. The mihomo core receives the final configuration and processes network traffic. A toggle in the client may generate a configuration field, send a runtime control command, or simply represent a UI option. When troubleshooting a complex issue, inspect the configuration that is actually active, not just the original subscription file.
Local overrides let you keep personal rules, but make sure you understand merge precedence. Editing a subscription file directly can mean your changes disappear on the next update. Defining the same field in a subscription, an override, and the client UI can also make its source unclear. A safer approach is to use the subscription to manage proxies and keep only a few explicit personal preferences in local overrides. Review important rules after each update.
Release Notes and Reproducing Issues
Client and core updates do not always happen at the same time. Read the release notes before updating to check for configuration migrations, permission changes, or networking updates. If your setup is stable, back up your configuration and override files before upgrading one component at a time. After updating, recheck listening ports, DNS handling, rule matches, and TUN routes, especially fields whose behavior may have changed since your configuration was written.
When reporting an issue to the community, include your operating system, client name, core details, reproduction steps, and a redacted log excerpt. Remove credentials from subscription URLs, proxy passwords, and private domain names, while preserving the relevant field hierarchy and error context. Issues that reproduce with a minimal configuration are easier to distinguish from client integration behavior and make troubleshooting steps more useful to others.
Examples in configuration guides illustrate individual mechanisms, not complete setups. Match rule targets, provider names, file paths, and listening addresses to your environment. When combining snippets from different sources, check for duplicate top-level keys and verify that all references resolve. Keep a record of rule changes; if something breaks, reverting to a verified configuration makes it easier to find the cause than replacing everything at once.
Clash Tips and Guides
Find repeatable checks for port conflicts, syncing settings across devices, and connection problems. Articles are listed by publication date, newest first. Configuration steps may need to be adapted to the current client interface.
Check system proxy settings, mode and rules, proxy availability, DNS resolution, TUN, and firewall in order to find out why Clash connects but you still can't access the internet.
Compare three ways to sync settings: distributing a subscription link, syncing a configuration folder through cloud storage, and syncing local override files. Learn which approach works best on desktop and mobile, and what to watch for.
Use built-in system commands to identify processes occupying ports such as 7890. Then change mixed-port in the configuration file and client settings, and update the system proxy to match.